rbac:
  create: true

serviceAccount:
  create: true
  name: kubelatte-sa
  annotations: {}


podSecurityContext:
  enabled: true
  fsGroup: 1006380000
  runAsNonRoot: true
#  seccompProfile:
#    type: "RuntimeDefault"

terminationGracePeriodSeconds: 10
restartPolicy: Always

image:
  registry: kubelatte
  repository: kubelatte
  tag: latest

  ## Specify a imagePullPolicy
  ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
  ## ref: https://kubernetes.io/docs/concepts/containers/images/#pre-pulled-images
  ##
  pullPolicy: IfNotPresent
  ## Optionally specify an array of imagePullSecrets (secrets must be manually created in the namespace)
  ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
  ## e.g:
  ## pullSecrets:
  ##   - myRegistryKeySecretName
  ##
  pullSecrets:
    - pull

# Webhooks
webhookConfigs:
  enabled: true
  mutating:
    - name: kubelatte-ce
      webhooks:
        - name: kubelatte.community.edition
          rules:
            - operations:
                - CREATE
              apiGroups:
                - ''
              apiVersions:
                - v1
              resources:
                - pods
              scope: '*'
          failurePolicy: Ignore
          namespaceSelector:
            matchExpressions:
              - key: kubelatte-injection
                operator: In
                values:
                  - enabled
          objectSelector: {}
          timeoutSeconds: 5

  validating:
    - name: kubelatte-ce
      webhooks:
        - name: kubelatte.community.edition
          rules:
            - operations:
                - CREATE
              apiGroups:
                - ''
              apiVersions:
                - v1
              resources:
                - pods
              scope: '*'
          failurePolicy: Ignore
          namespaceSelector:
            matchExpressions:
              - key: kubelatte-injection
                operator: In
                values:
                  - enabled
          objectSelector: {}
          timeoutSeconds: 5

  auth:
    tls:
      certBase64:
      keyBase64:
      caCertBase64:

resources:
  limits:
    cpu: 300m
    memory: 500Mi
  requests:
    cpu: 300m
    memory: 500Mi

livenessProbe:
  enabled: true
  initialDelaySeconds: 15
  timeoutSeconds: 1
  periodSeconds: 20
  successThreshold: 1
  failureThreshold: 30
readinessProbe:
  enabled: true
  ## may be your own
  initialDelaySeconds: 1
  timeoutSeconds: 1
  periodSeconds: 2
  successThreshold: 1
  failureThreshold: 30

containerSecurityContext:
  enabled: true
  ## may be your own
  privileged: false
  runAsUser: 10101
  runAsGroup: 10101
  runAsNonRoot: true
  readOnlyRootFilesystem: true
  allowPrivilegeEscalation: false
  capabilities:
    drop: ["ALL"]
#  seccompProfile:
#    type: "RuntimeDefault"

service:
  name: kubelatte-ce-service
  port: 8443


modes:
  mutation:
    enabled: true
    sideEffect:
      enabled: true
      recreation:
        enabled: true
  validation:
    enabled: true
  creation:
    enabled: true
    clusterCreation: true